@podosoft/podokit 0.14.0 → 0.16.0

package/dist/templates/modules/sse/files/apps/api/src/events/events.module.ts

@@ -1,12 +1,19 @@
 import { Global, Module } from "@nestjs/common";
 import { EventsController } from "./events.controller";
-import { EventsService } from "./events.service";
+import { EVENTS_TRANSPORT, EventsService } from "./events.service";
+import { createEventsTransport } from "./events.transport";
 
 // Global so any module can inject EventsService to broadcast updates.
 @Global()
 @Module({
   controllers: [EventsController],
-  providers: [EventsService],
+  providers: [
+    {
+      provide: EVENTS_TRANSPORT,
+      useFactory: () => createEventsTransport(),
+    },
+    EventsService,
+  ],
   exports: [EventsService],
 })
 export class EventsModule {}

package/dist/templates/modules/sse/files/apps/api/src/events/events.service.spec.ts

@@ -0,0 +1,61 @@
+import { describe, expect, it } from "@jest/globals";
+import { firstValueFrom, take } from "rxjs";
+import { ReadinessService } from "../health/readiness.service";
+import { EventsService } from "./events.service";
+import type { EventHandler, EventsTransport } from "./events.transport";
+
+class TestTransport implements EventsTransport {
+  handler?: EventHandler;
+  published: unknown[] = [];
+  available = true;
+
+  connect(handler: EventHandler): Promise<void> {
+    this.handler = handler;
+    return Promise.resolve();
+  }
+
+  publish(data: unknown): Promise<void> {
+    if (!this.available) return Promise.reject(new Error("unavailable"));
+    this.published.push(data);
+    this.handler?.(data);
+    return Promise.resolve();
+  }
+
+  ready(): Promise<void> {
+    return this.available ? Promise.resolve() : Promise.reject(new Error("unavailable"));
+  }
+
+  close(): Promise<void> {
+    return Promise.resolve();
+  }
+}
+
+describe("EventsService", () => {
+  it("publishes through the transport and exposes local delivery", async () => {
+    const transport = new TestTransport();
+    const readiness = new ReadinessService();
+    const service = new EventsService(transport, readiness);
+    await service.onModuleInit();
+
+    const next = firstValueFrom(service.asObservable().pipe(take(1)));
+    await service.publishAsync({ type: "changed" });
+    await expect(next).resolves.toEqual({ data: { type: "changed" } });
+    expect(transport.published).toEqual([{ type: "changed" }]);
+
+    await expect(readiness.run()).resolves.toEqual({ events: "up" });
+    await service.onModuleDestroy();
+    await expect(readiness.run()).resolves.toEqual({});
+  });
+
+  it("reports a failed transport through publishAsync and readiness", async () => {
+    const transport = new TestTransport();
+    const readiness = new ReadinessService();
+    const service = new EventsService(transport, readiness);
+    await service.onModuleInit();
+    transport.available = false;
+
+    await expect(service.publishAsync({ type: "changed" })).rejects.toThrow("unavailable");
+    await expect(readiness.run()).resolves.toEqual({ events: "down" });
+    await service.onModuleDestroy();
+  });
+});

package/dist/templates/modules/sse/files/apps/api/src/events/events.service.ts

@@ -1,17 +1,57 @@
-import { Injectable, type MessageEvent } from "@nestjs/common";
+import {
+  Inject,
+  Injectable,
+  Logger,
+  type MessageEvent,
+  type OnModuleDestroy,
+  type OnModuleInit,
+} from "@nestjs/common";
 import { Observable, Subject } from "rxjs";
+import { ReadinessService } from "../health/readiness.service";
+import type { EventsTransport } from "./events.transport";
+
+export const EVENTS_TRANSPORT = Symbol("EVENTS_TRANSPORT");
 
 @Injectable()
-export class EventsService {
+export class EventsService implements OnModuleInit, OnModuleDestroy {
+  private readonly logger = new Logger(EventsService.name);
   private readonly subject = new Subject<MessageEvent>();
+  private unregisterReadiness?: () => void;
+
+  constructor(
+    @Inject(EVENTS_TRANSPORT) private readonly transport: EventsTransport,
+    private readonly readiness: ReadinessService,
+  ) {}
+
+  async onModuleInit(): Promise<void> {
+    await this.transport.connect((data) => this.publishLocal(data));
+    this.unregisterReadiness = this.readiness.register("events", () => this.transport.ready());
+  }
 
-  // Push an event to all connected clients. Inject this service anywhere
-  // (e.g. a queue processor) to broadcast progress or notifications.
   publish(data: unknown): void {
+    void this.publishAsync(data).catch((error: unknown) => {
+      this.logger.error(
+        "Failed to publish event",
+        error instanceof Error ? error.stack : undefined,
+      );
+    });
+  }
+
+  publishAsync(data: unknown): Promise<void> {
+    return this.transport.publish(data);
+  }
+
+  publishLocal(data: unknown): void {
     this.subject.next({ data } as MessageEvent);
   }
 
   asObservable(): Observable<MessageEvent> {
     return this.subject.asObservable();
   }
+
+  async onModuleDestroy(): Promise<void> {
+    this.unregisterReadiness?.();
+    this.subject.complete();
+    await this.transport.close();
+  }
 }

package/dist/templates/modules/sse/files/apps/api/src/events/events.transport.redis.spec.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "@jest/globals";
+import { RedisEventsTransport } from "./events.transport";
+
+const redisUrl = process.env.REDIS_TEST_URL;
+const integrationTest = redisUrl ? it : it.skip;
+
+describe("RedisEventsTransport integration", () => {
+  integrationTest("delivers once to every connected replica", async () => {
+    const channel = `podokit:test:${Date.now()}:${Math.random().toString(36).slice(2)}`;
+    const env = {
+      REDIS_URL: redisUrl,
+      SSE_REDIS_CHANNEL: channel,
+      SSE_MAX_EVENT_BYTES: "1024",
+    };
+    const first = new RedisEventsTransport(env);
+    const second = new RedisEventsTransport(env);
+    const firstEvents: unknown[] = [];
+    const secondEvents: unknown[] = [];
+
+    try {
+      await first.connect((data) => firstEvents.push(data));
+      await second.connect((data) => secondEvents.push(data));
+      await first.publish({ type: "replica-test" });
+
+      const deadline = Date.now() + 3000;
+      while (
+        Date.now() < deadline &&
+        (firstEvents.length < 1 || secondEvents.length < 1)
+      ) {
+        await new Promise((resolve) => setTimeout(resolve, 20));
+      }
+      await new Promise((resolve) => setTimeout(resolve, 100));
+
+      expect(firstEvents).toEqual([{ type: "replica-test" }]);
+      expect(secondEvents).toEqual([{ type: "replica-test" }]);
+      await expect(first.ready()).resolves.toBeUndefined();
+      await expect(second.ready()).resolves.toBeUndefined();
+    } finally {
+      await Promise.all([first.close(), second.close()]);
+    }
+  });
+});

package/dist/templates/modules/sse/files/apps/api/src/events/events.transport.spec.ts

@@ -0,0 +1,97 @@
+import { describe, expect, it } from "@jest/globals";
+import {
+  MemoryEventsTransport,
+  RedisEventsTransport,
+  type RedisClientFactory,
+} from "./events.transport";
+import type { RedisConnectionOptions } from "../config/redis.connection";
+
+class FakeRedisClient {
+  status = "wait";
+  readonly published: Array<{ channel: string; message: string }> = [];
+  readonly subscriptions: string[] = [];
+  private messageListener?: (channel: string, message: string) => void;
+
+  connect(): Promise<void> {
+    this.status = "ready";
+    return Promise.resolve();
+  }
+
+  publish(channel: string, message: string): Promise<number> {
+    this.published.push({ channel, message });
+    return Promise.resolve(1);
+  }
+
+  subscribe(channel: string): Promise<number> {
+    this.subscriptions.push(channel);
+    return Promise.resolve(1);
+  }
+
+  ping(): Promise<string> {
+    return this.status === "ready" ? Promise.resolve("PONG") : Promise.reject(new Error("down"));
+  }
+
+  quit(): Promise<string> {
+    this.status = "end";
+    return Promise.resolve("OK");
+  }
+
+  on(_event: "message", listener: (channel: string, message: string) => void): this {
+    this.messageListener = listener;
+    return this;
+  }
+
+  off(_event: "message", listener: (channel: string, message: string) => void): this {
+    if (this.messageListener === listener) this.messageListener = undefined;
+    return this;
+  }
+
+  emit(channel: string, message: string): void {
+    this.messageListener?.(channel, message);
+  }
+}
+
+describe("events transports", () => {
+  it("delivers memory events through the configured handler", async () => {
+    const transport = new MemoryEventsTransport({ SSE_MAX_EVENT_BYTES: "128" });
+    const received: unknown[] = [];
+    await transport.connect((data) => received.push(data));
+    await transport.publish({ type: "changed" });
+    expect(received).toEqual([{ type: "changed" }]);
+  });
+
+  it("publishes Redis events only through the subscription echo", async () => {
+    const clients: FakeRedisClient[] = [];
+    const factory: RedisClientFactory = (_options: RedisConnectionOptions) => {
+      const client = new FakeRedisClient();
+      clients.push(client);
+      return client;
+    };
+    const transport = new RedisEventsTransport(
+      {
+        REDIS_URL: "redis://user:password@cache.example.com:6379/2",
+        SSE_REDIS_CHANNEL: "events:test",
+      },
+      factory,
+    );
+    const received: unknown[] = [];
+
+    await transport.connect((data) => received.push(data));
+    await transport.publish({ type: "changed" });
+    expect(received).toEqual([]);
+    expect(clients[0]?.published).toEqual([
+      { channel: "events:test", message: '{"type":"changed"}' },
+    ]);
+
+    clients[1]?.emit("events:test", '{"type":"changed"}');
+    expect(received).toEqual([{ type: "changed" }]);
+  });
+
+  it("rejects events larger than the configured limit", async () => {
+    const transport = new MemoryEventsTransport({ SSE_MAX_EVENT_BYTES: "8" });
+    await transport.connect(() => undefined);
+    await expect(transport.publish({ message: "too large" })).rejects.toThrow(
+      "Event data exceeds SSE_MAX_EVENT_BYTES",
+    );
+  });
+});

package/dist/templates/modules/sse/files/apps/api/src/events/events.transport.ts

@@ -0,0 +1,165 @@
+import { Logger } from "@nestjs/common";
+import Redis from "ioredis";
+import {
+  redisConnectionOptions,
+  type RedisConnectionOptions,
+} from "../config/redis.connection";
+
+export type EventHandler = (data: unknown) => void;
+
+export interface EventsTransport {
+  connect(handler: EventHandler): Promise<void>;
+  publish(data: unknown): Promise<void>;
+  ready(): Promise<void>;
+  close(): Promise<void>;
+}
+
+interface RedisClient {
+  readonly status: string;
+  connect(): Promise<void>;
+  publish(channel: string, message: string): Promise<number>;
+  subscribe(channel: string): Promise<unknown>;
+  ping(): Promise<string>;
+  quit(): Promise<string>;
+  on(event: "message", listener: (channel: string, message: string) => void): this;
+  off(event: "message", listener: (channel: string, message: string) => void): this;
+}
+
+export type RedisClientFactory = (options: RedisConnectionOptions) => RedisClient;
+
+function defaultRedisClientFactory(options: RedisConnectionOptions): RedisClient {
+  return new Redis(options);
+}
+
+function maxEventBytes(env: NodeJS.ProcessEnv): number {
+  const value = Number(env.SSE_MAX_EVENT_BYTES ?? 65_536);
+  if (!Number.isInteger(value) || value < 1) {
+    throw new Error("SSE_MAX_EVENT_BYTES must be a positive integer");
+  }
+  return value;
+}
+
+function encodedEvent(data: unknown, maximumBytes: number): string {
+  const message = JSON.stringify(data);
+  if (message === undefined) {
+    throw new Error("Event data must be JSON serializable");
+  }
+  if (Buffer.byteLength(message, "utf8") > maximumBytes) {
+    throw new Error("Event data exceeds SSE_MAX_EVENT_BYTES");
+  }
+  return message;
+}
+
+export class MemoryEventsTransport implements EventsTransport {
+  private handler?: EventHandler;
+  private readonly maximumBytes: number;
+
+  constructor(env: NodeJS.ProcessEnv = process.env) {
+    this.maximumBytes = maxEventBytes(env);
+  }
+
+  connect(handler: EventHandler): Promise<void> {
+    this.handler = handler;
+    return Promise.resolve();
+  }
+
+  async publish(data: unknown): Promise<void> {
+    const message = encodedEvent(data, this.maximumBytes);
+    this.handler?.(JSON.parse(message) as unknown);
+  }
+
+  ready(): Promise<void> {
+    return Promise.resolve();
+  }
+
+  close(): Promise<void> {
+    this.handler = undefined;
+    return Promise.resolve();
+  }
+}
+
+export class RedisEventsTransport implements EventsTransport {
+  private readonly logger = new Logger(RedisEventsTransport.name);
+  private readonly publisher: RedisClient;
+  private readonly subscriber: RedisClient;
+  private readonly channel: string;
+  private readonly maximumBytes: number;
+  private handler?: EventHandler;
+
+  constructor(
+    env: NodeJS.ProcessEnv = process.env,
+    createClient: RedisClientFactory = defaultRedisClientFactory,
+  ) {
+    this.channel = env.SSE_REDIS_CHANNEL?.trim() || "podokit:events";
+    this.maximumBytes = maxEventBytes(env);
+    this.publisher = createClient(
+      redisConnectionOptions(env, {
+        lazyConnect: true,
+        enableReadyCheck: true,
+        maxRetriesPerRequest: 1,
+        connectTimeout: 5_000,
+        commandTimeout: 5_000,
+      }),
+    );
+    this.subscriber = createClient(
+      redisConnectionOptions(env, {
+        lazyConnect: true,
+        enableReadyCheck: true,
+        maxRetriesPerRequest: null,
+        connectTimeout: 5_000,
+      }),
+    );
+  }
+
+  private readonly onMessage = (channel: string, message: string): void => {
+    if (channel !== this.channel) return;
+    if (Buffer.byteLength(message, "utf8") > this.maximumBytes) {
+      this.logger.warn("Discarded oversized event transport message");
+      return;
+    }
+    try {
+      this.handler?.(JSON.parse(message) as unknown);
+    } catch {
+      this.logger.warn("Discarded malformed event transport message");
+    }
+  };
+
+  async connect(handler: EventHandler): Promise<void> {
+    this.handler = handler;
+    this.subscriber.on("message", this.onMessage);
+    try {
+      await Promise.all([this.publisher.connect(), this.subscriber.connect()]);
+      await this.subscriber.subscribe(this.channel);
+      await this.ready();
+    } catch (error) {
+      this.subscriber.off("message", this.onMessage);
+      this.handler = undefined;
+      await Promise.allSettled([this.publisher.quit(), this.subscriber.quit()]);
+      throw error;
+    }
+  }
+
+  async publish(data: unknown): Promise<void> {
+    await this.publisher.publish(this.channel, encodedEvent(data, this.maximumBytes));
+  }
+
+  async ready(): Promise<void> {
+    if (this.subscriber.status !== "ready") {
+      throw new Error("Redis event subscriber is not ready");
+    }
+    await this.publisher.ping();
+  }
+
+  async close(): Promise<void> {
+    this.subscriber.off("message", this.onMessage);
+    this.handler = undefined;
+    await Promise.allSettled([this.publisher.quit(), this.subscriber.quit()]);
+  }
+}
+
+export function createEventsTransport(env: NodeJS.ProcessEnv = process.env): EventsTransport {
+  const name = env.SSE_TRANSPORT?.trim().toLowerCase() || "memory";
+  if (name === "memory") return new MemoryEventsTransport(env);
+  if (name === "redis") return new RedisEventsTransport(env);
+  throw new Error('SSE_TRANSPORT must be either "memory" or "redis"');
+}

package/dist/templates/modules/sse/files/tests/api/events.api.spec.ts

@@ -1,6 +1,7 @@
 import { expect, test } from "@playwright/test";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const secondaryApi = process.env.E2E_SECONDARY_API_URL;
 const origin = { origin: base };
 
 async function session(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
@@ -44,3 +45,43 @@ test("sse: a published message is delivered over the event stream @smoke", async
   expect(seen).toBe(true);
   await ctx.dispose();
 });
+
+test("sse: a second API replica delivers through Redis", async ({ playwright }) => {
+  test.skip(!secondaryApi, "a secondary API replica is not configured");
+  const ctx = await session(playwright);
+  const cookies = (await ctx.storageState()).cookies.map((c) => `${c.name}=${c.value}`).join("; ");
+  const ac = new AbortController();
+  const stream = await fetch(`${base}/api/events/stream`, {
+    headers: { ...origin, cookie: cookies },
+    signal: ac.signal,
+  });
+  expect(stream.ok).toBe(true);
+  expect(stream.body).not.toBeNull();
+
+  const msg = `replica-${Date.now()}`;
+  const published = await fetch(`${secondaryApi}/events`, {
+    method: "POST",
+    headers: {
+      ...origin,
+      cookie: cookies,
+      "content-type": "application/json",
+    },
+    body: JSON.stringify({ message: msg }),
+  });
+  expect(published.ok).toBe(true);
+
+  const reader = stream.body!.getReader();
+  const decoder = new TextDecoder();
+  let seen = 0;
+  let buffered = "";
+  const deadline = Date.now() + 8000;
+  while (Date.now() < deadline && seen === 0) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    buffered += decoder.decode(value, { stream: true });
+    seen = buffered.split(msg).length - 1;
+  }
+  ac.abort();
+  expect(seen).toBe(1);
+  await ctx.dispose();
+});

package/dist/templates/modules/sse/module.manifest.json

@@ -1,9 +1,21 @@
 {
   "name": "sse",
-  "description": "Server-Sent Events: a /events/stream endpoint (heartbeat + published messages) and a POST /events publisher.",
+  "description": "Server-Sent Events with memory or Redis transport for multi-replica delivery.",
   "requires": [],
+  "requiredProjectFiles": [
+    "apps/api/src/config/redis.connection.ts",
+    "apps/api/src/health/readiness.service.ts"
+  ],
   "targetApp": "api",
-  "env": [],
+  "dependencies": {
+    "ioredis": "^5.4.1"
+  },
+  "env": [
+    "# Server-Sent Events transport: memory for one API replica, redis for multiple replicas",
+    "SSE_TRANSPORT=memory",
+    "SSE_REDIS_CHANNEL=podokit:events",
+    "SSE_MAX_EVENT_BYTES=65536"
+  ],
   "inject": [
     { "file": "apps/api/src/app.module.ts", "marker": "// podokit:end:imports", "text": "import { EventsModule } from \"./events/events.module\";" },
     { "file": "apps/api/src/app.module.ts", "marker": "// podokit:end:module-imports", "text": "EventsModule," }
@@ -11,6 +23,7 @@
   "instructions": [
     "Stream events:  curl -N localhost:5002/events/stream",
     "Publish a message (in another terminal):  curl -XPOST localhost:5002/events -H 'content-type: application/json' -d '{\"message\":\"hello\"}'",
-    "Inject EventsService anywhere to push updates (e.g. job progress)."
+    "Set SSE_TRANSPORT=redis for delivery across API replicas; Redis uses the shared REDIS_URL or individual Redis settings.",
+    "Inject EventsService and call publishAsync for confirmed delivery, publish for best-effort delivery, or publishLocal for events already fanned out to every replica."
   ]
 }

package/dist/templates/todo/AGENTS.md

@@ -70,6 +70,7 @@ Useful commands:
 - `podo remove <module>` — un-apply a module (inverse of add; refuses if another module needs it, keeps files you edited).
 - `podo status` / `podo diff` — see your local edits vs. what PodoKit generated.
 - `podo update` — pull in template/module improvements (3-way merges your edits; never touches owned files).
+- `podo deploy` — plan, apply, verify, or roll back an immutable Kubernetes release. Use `.agents/skills/podokit-deploy`.
 
 ## Commit conventions
 

package/dist/templates/todo/README.md

@@ -33,16 +33,17 @@ npx @podosoft/podokit dev logs
 npx @podosoft/podokit dev down
 ```
 
-If installed modules require extra services, use their profiles on the initial
-watch command instead:
+`dev watch` reads `.podokit/manifest.json` and automatically activates `cache`,
+`storage`, and `queue` when installed modules require Redis, MinIO, or a worker.
+You can still activate an additional Compose profile explicitly:
 
 ```bash
-npx @podosoft/podokit dev watch \
-  --profile cache --profile storage --profile queue
+npx @podosoft/podokit dev watch --profile dev
 ```
 
-Pass the same profile flags to other lifecycle commands when applicable. `dev down`
-removes this project's stack and route. If it is the final registered
+Explicit profile flags are preserved for other lifecycle commands. `dev down`
+activates all profiles while removing this project's stack and route. If it is
+the final registered
 project, it also removes the shared gateway and network. Source changes are synced
 through Compose Watch, including Vite HMR on the same portless browser origin.
 
@@ -78,5 +79,8 @@ The API uses TypeORM with PostgreSQL. A sample `Todo` entity and an initial migr
 
 ## Deploy
 
-Docker Compose in `infra/docker`; example k3s manifests in `infra/k3s`
-(use `secret.example.yaml` as a template — never commit real secrets).
+Docker Compose lives in `infra/docker`; the basic k3s manifests in `infra/k3s`
+route every public path through the web proxy. Use `podo deploy init`, `doctor`,
+and `plan` for an exact-image Helm release on an existing cluster. Applying or
+rolling back requires the exact confirmation hash from a fresh plan. See the
+PodoKit [deployment guide](https://github.com/podosoft-dev/podokit/blob/main/docs/deployment.md).

package/dist/templates/todo/apps/api/Dockerfile

@@ -16,12 +16,12 @@ RUN npm run build --workspace=apps/api
 FROM node:22-alpine AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
-RUN addgroup -S app && adduser -S app -G app
+RUN addgroup -S -g 101 app && adduser -S -D -H -u 100 -G app app
 COPY --from=build /app/node_modules ./node_modules
 COPY --from=deps /app/apps/api ./apps/api
 COPY --from=build /app/apps/api/dist ./apps/api/dist
 COPY --from=build /app/apps/api/scripts ./apps/api/scripts
 WORKDIR /app/apps/api
-USER app
+USER 100:101
 EXPOSE 3000
 CMD ["node", "dist/main"]

package/dist/templates/todo/apps/api/package.json

@@ -8,6 +8,7 @@
     "start": "node dist/main",
     "lint": "tsc -p tsconfig.json --noEmit",
     "test": "jest --passWithNoTests",
+    "migrate:all": "node dist/database/migrate",
     "typeorm": "typeorm-ts-node-commonjs -d src/database/data-source.ts",
     "migration:run": "npm run typeorm -- migration:run",
     "migration:revert": "npm run typeorm -- migration:revert",

package/dist/templates/todo/apps/api/src/config/redis.connection.spec.ts

@@ -0,0 +1,53 @@
+import { describe, expect, it } from "@jest/globals";
+import { redisConnectionOptions } from "./redis.connection";
+
+describe("redisConnectionOptions", () => {
+  it("prefers an authenticated URL over individual settings", () => {
+    expect(
+      redisConnectionOptions({
+        REDIS_URL: "rediss://user:p%40ss@cache.example.com:6381/4",
+        REDIS_HOST: "ignored",
+        REDIS_PASSWORD: "ignored",
+      }),
+    ).toEqual({
+      host: "cache.example.com",
+      port: 6381,
+      db: 4,
+      username: "user",
+      password: "p@ss",
+      tls: {},
+    });
+  });
+
+  it("uses authenticated host settings when a URL is absent", () => {
+    expect(
+      redisConnectionOptions({
+        REDIS_HOST: "cache",
+        REDIS_PORT: "6380",
+        REDIS_DB: "2",
+        REDIS_USERNAME: "app",
+        REDIS_PASSWORD: "secret",
+        REDIS_TLS: "true",
+      }),
+    ).toEqual({
+      host: "cache",
+      port: 6380,
+      db: 2,
+      username: "app",
+      password: "secret",
+      tls: {},
+    });
+  });
+
+  it("does not include a malformed URL value in its error", () => {
+    const secretUrl = "not-a-url-with-a-secret";
+    expect(() => redisConnectionOptions({ REDIS_URL: secretUrl })).toThrow(
+      "REDIS_URL must be a valid redis:// or rediss:// URL",
+    );
+    try {
+      redisConnectionOptions({ REDIS_URL: secretUrl });
+    } catch (error) {
+      expect(String(error)).not.toContain(secretUrl);
+    }
+  });
+});